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[57] ABSTRACT 

A system for securely using digital signatures in a commer- 
cial cryptographic system that allows industry-wide security 
policy and authorization information to be encoded into the 
signatures and certificates by employing attribute certificates 
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tion can enforce with respect to any transaction geographical 
and temporal controls, age-of-signature limitations, preap- 
proved counterparty limitations and confirm-to requirements 
by using attribute certificates for the transacting user. 
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attribute certificates. Certificates can be used also to ensure 
key confinement and non-decryption requirements of smart- 
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Detailed Description Text - DETX (44): 

The attribute values of delegation controls can limit the types and value 
ranges of authorizations that a CA may specify when issuing an attribute 
certificate. They can also serve to limit the scope and depth to which a user 
may delegate his signing authority to others. For example, a root CA might 
limit an organizational CA to issuing authorizations only to allow its end 
users to sign documents whose document types fall into a range of documents 
related to state tax administration. Or a CA might grant some authority to a 
user with the provision that it can be delegated only to another person with 
the rank of assistant treasurer or higher, for a time not to exceed thirty 
days, and without the right to further subdelegate. 



Detailed Description Text - DETX (48): 

A set of basic policies must be defined for use throughout the financial 
services industry and other industries in order to provide a well-defined, 
predictable level of service for the verification process. These policies 
would be agreed to on a multilateral basis by every participating firm and 
could stipulate that certain of the restrictions and authorizations discussed 
in this section would always be deemed to be in effect unless expressly 
provided otherwise. One of the more important elements of these industry 
agreements would be the definition and coding of document types. This must be 
done on a per-industry basis, since the rules will obviously be much different, 
for instance, for customs inspectors, aircraft inspectors, auditors, tax 
officials, etc. 
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